Merge pull request 'Upgrade Liquor Cabinet to 2.0.0-rc.2 (hashed tokens), deploy new Akkounts' (#695) from chore/upgrade_akkounts-and-lq into master

Reviewed-on: #695

data_bags/credentials/liquor-cabinet.json

@@ -1,17 +1,17 @@
 {
   "id": "liquor-cabinet",
   "s3_access_key": {
-    "encrypted_data": "TKYUWVboQZUKvw4bqrKsL28dH2DGR5iDBQclAwm5I7GqkxFfkG2d91qLv+BA\n",
-    "iv": "B8YYzXeFGxMG34WI\n",
-    "auth_tag": "HOIfcpJOFYIVvf5o8lk4mg==\n",
+    "encrypted_data": "OLx6rlsOpI6CEJoDKK8NzF9o5PZzjKW7euQ1DOaVV+zWgxqdDn0Ow2iDhy6L\n",
+    "iv": "DC8MCr3dAgOtmumh\n",
+    "auth_tag": "bCZAYhWPipCy/jkY5hofoA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_secret_key": {
-    "encrypted_data": "GRqGJkGJ/f0zQVtO0r9TcXBqlpnfC5PiwTZK8QmsqEhzQI6U67NAf62QqTgl\nGVI1h8G5ITgC3l0xVhcvH6m2bcs9fjNzFIqnhoZhzGwEt51A5Zk=\n",
-    "iv": "UAlmoUWLedpd79xa\n",
-    "auth_tag": "2F/EJhY5/59dtFFwkd106A==\n",
+    "encrypted_data": "4ZGXnzuoCNRhFrOapt6dFagJjhb4nzMFqRfdsaUI7tzbV1Xvvp63MUs/z7UT\nUp0vJyTDAKTTZ5AV0BWz+HWzQ3Wkk3EgGd7FGJrLzuwXe2MuEFE=\n",
+    "iv": "aqh92wCSwywZtKda\n",
+    "auth_tag": "AshKWo/k4fv0iofsVov1OA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }
-}
+}

site-cookbooks/liquor_cabinet/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 This file is used to list changes made in each version of the liquor_cabinet cookbook.
 
+## 0.3.0
+
+- Pin Liquor Cabinet to the 2.0.0-rc.2 release.
+- Enable hashed remoteStorage access token lookup (`hashed_access_tokens`),
+  so authorizations are read by the SHA256 digest of the bearer token, with
+  the plaintext key kept as a fallback.
+
 ## 0.2.0
 
 - Add Redis password support.

site-cookbooks/liquor_cabinet/attributes/default.rb

@@ -2,7 +2,7 @@ node.default['liquor-cabinet']['app_name'] = "liquor-cabinet"
 node.default['liquor-cabinet']['user'] = "deploy"
 node.default['liquor-cabinet']['group'] = "deploy"
 node.default['liquor-cabinet']['repo'] = 'https://gitea.kosmos.org/5apps/liquor-cabinet.git'
-node.default['liquor-cabinet']['revision'] = 'master'
+node.default['liquor-cabinet']['revision'] = '2.0.0-rc.2'
 node.default['liquor-cabinet']['deploy_path'] = "/opt/#{node['liquor-cabinet']['app_name']}"
 node.default['liquor-cabinet']['redis_server_role'] = 'redis_server'
 node.default['liquor-cabinet']['redis_port'] = 6379
@@ -12,6 +12,7 @@ node.default['liquor-cabinet']['s3_region'] = nil
 node.default['liquor-cabinet']['s3_bucket'] = nil
 node.default['liquor-cabinet']['ufw_source_allowed'] = nil
 node.default['liquor-cabinet']['maintenance_mode_enabled'] = false
+node.default['liquor-cabinet']['hashed_access_tokens'] = true
 node.default['liquor-cabinet']['ruby']['version'] = "3.1.4"
 node.default['liquor-cabinet']['rainbows'] = {
   'port' => 3000,

site-cookbooks/liquor_cabinet/metadata.rb

@@ -3,7 +3,7 @@ maintainer 'Kosmos Developers'
 maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures the Liquor Cabinet remoteStorage API server'
-version '0.2.0'
+version '0.3.0'
 chef_version '>= 18.2'
 issues_url 'https://gitea.kosmos.org/kosmos/chef/issues'
 # source_url 'https://gitea.kosmos.org/kosmos/chef'

site-cookbooks/liquor_cabinet/recipes/default.rb

@@ -79,7 +79,8 @@ template "#{deploy_path}/config.yml.erb" do
             s3_bucket: node[app_name]['s3_bucket'],
             s3_access_key: credentials['s3_access_key'],
             s3_secret_key: credentials['s3_secret_key'],
-            maintenance_mode_enabled: node[app_name]['maintenance_mode_enabled']
+            maintenance_mode_enabled: node[app_name]['maintenance_mode_enabled'],
+            hashed_access_tokens: node[app_name]['hashed_access_tokens']
             # TODO sentry_dsn: credentials['sentry_dsn']
   notifies :restart, "service[#{app_name}]", :delayed
 end

site-cookbooks/liquor_cabinet/templates/config.yml.erb

@@ -1,5 +1,6 @@
 <%= @environment %>:
   maintenance: <%= @maintenance_mode_enabled %>
+  hashed_access_tokens: <%= @hashed_access_tokens %>
   redis:
     host: <%= @redis_host %>
     port: <%= @redis_port %>